feat(mail): Z-Push Exchange ActiveSync gateway for mobile clients

Wraps Stalwart in EAS so iOS/Android native Mail/Calendar 'Exchange'
accounts get two-way mail+calendar+contacts sync (BackendCombined:
IMAP + CalDAV /dav/cal/%l/ + CardDAV, credentials pass through).

- services/zpush: Z-Push 2.6.4 (AGPLv3, see LICENSE-NOTES.md) on
  php:8.2-apache-bookworm (trixie dropped libc-client); PHP 8 sysv
  sprintf fatal sed-patched; autodiscover dispatcher answers
  mobilesync schema, proxies outlook schema to Stalwart unchanged
- prod: zpush Deployment (replicas:1, Recreate — file sync state),
  /Microsoft-Server-ActiveSync Ingress on mail.dezky.eu (no redirect,
  POST-heavy), autodiscover.dezky.eu repointed to the dispatcher,
  selectorless stalwart-imaps/-smtps Services (host-Stalwart is
  implicit-TLS only: 993/465, no plain 143/587 — verified on node1)
- CI: build+deploy zpush like the other apps

EAS tops out at 14.1: covers native mobile clients, NOT the Outlook
mobile app (needs 16.1) and not new Outlook for Windows (no EAS).

services/zpush/LICENSE-NOTES.md

@@ -0,0 +1,37 @@
+# Z-Push licensing notes (AGPLv3)
+
+This image bundles [Z-Push](https://github.com/EGroupware/z-push) (EGroupware
+fork), licensed under the **GNU Affero General Public License v3**.
+
+## Why this doesn't affect dezky's own code
+
+Z-Push runs as an **isolated network service**. dezky components talk to it
+only over network protocols (HTTPS for EAS clients; Z-Push itself talks to
+Stalwart over IMAP/CalDAV/CardDAV). Nothing links against Z-Push code, so the
+AGPL's copyleft does not extend to the portal, platform-api, or any other
+dezky service.
+
+## What the AGPL obliges us to do
+
+Because users interact with Z-Push over a network, AGPL §13 requires that we
+offer them the **corresponding source of the exact version we run, including
+our modifications**. Our modifications are:
+
+- the pinned upstream version (see `ZPUSH_VERSION` in the `Dockerfile` and
+  `/usr/share/z-push/DEZKY_PINNED_VERSION` in the image)
+- the replaced config files in `config/`
+- the autodiscover dispatcher `autodiscover-router.php`
+- two sed-patched values in the main `config.php` (TIMEZONE,
+  BACKEND_PROVIDER — see `Dockerfile`)
+- a one-line PHP 8 fix in
+  `backend/ipcsharedmemory/ipcsharedmemoryprovider.php` (a debug sprintf of
+  SysV handles that are objects, not resources, since PHP 8.0 — see
+  `Dockerfile`)
+
+Everything lives self-contained in this directory. **Compliance action:** the
+client-setup/help page that documents Exchange account setup must link to
+(a) the upstream tag on GitHub and (b) this directory's contents (or a
+published copy of them). Keep that link in step with `ZPUSH_VERSION` bumps.
+
+Z-Push's own license text ships in the image at `/usr/share/z-push` (see the
+upstream `LICENSE` file in the cloned repository root).